From 247bc10c264aa0287dc58911bb4f34a742d9d784 Mon Sep 17 00:00:00 2001
From: Oleg Evseev <ev.mipt@gmail.com>
Date: Sun, 5 Jul 2020 19:04:47 +0300
Subject: [PATCH] drivers/can: fix wrong use of nxsem_getvalue

Bug caused increase of fifo->rx_sem with each received msg until finally after 32767 messages get into
DEBUGASSERT(sem->semcount<SEM_VALUE_MAX);
or stopping receiving anything at all without debug, while tx was working.

issue #1354
---
 drivers/can/can.c | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/drivers/can/can.c b/drivers/can/can.c
index 2a6e004b61..78842ecb00 100644
--- a/drivers/can/can.c
+++ b/drivers/can/can.c
@@ -1337,13 +1337,24 @@ int can_receive(FAR struct can_dev_s *dev, FAR struct can_hdr_s *hdr,
 
           fifo->rx_tail = nexttail;
 
-          /* The increment the counting semaphore. The maximum value should
+          sval = 0;
+          if (nxsem_get_value(&fifo->rx_sem, &sval) < 0)
+            {
+              DEBUGASSERT(false);
+#ifdef CONFIG_CAN_ERRORS
+              /* Report unspecified error */
+
+              dev->cd_error |= CAN_ERROR5_UNSPEC;
+#endif
+              return -EINVAL;
+            }
+
+          /* Increment the counting semaphore. The maximum value should
            * be CONFIG_CAN_FIFOSIZE -- one possible count for each allocated
            * message buffer.
            */
 
-          sval = 0;
-          if (nxsem_get_value(&fifo->rx_sem, &sval) <= 0)
+          if (sval < 0)
             {
               can_givesem(&fifo->rx_sem);
             }